CVE-2026-121396

FreeRDP clients version 3.0.0 before 3.32.2 built with verbose WinPR assertions are vulnerable to a denial of service (DoS). The root cause is a reachable assertion in rts_read_auth_verifier triggered by malformed RTS padding. An attacker controlling an RD Gateway can send a crafted RPC-over-HTTP...

CVE-2026-109678

FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scardcopystrings. A malicious RDP server can send an SCardStatusA request with...

EUVD-2026-98700

FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scardcopystrings. A malicious RDP server can send an SCardStatusA request with...